Security
Last updated: 15 October 2026
Your data security matters. Here's what we do today to keep Firmwatcher secure.
Data protection
UK GDPR
We process personal data under UK GDPR and the Data Protection Act 2018, with a published privacy policy and a data-controller contact.
Sub-processors
We do not sell customer data; we share it only with the sub-processors listed below. Some of them process data outside the UK.
Technical baseline
Encryption in transit & at rest
- • All HTTP traffic is served over TLS (managed by Vercel)
- • Passwords are never stored in plaintext – auth is delegated to Supabase, which hashes them
- • Database storage is encrypted at rest by Supabase
Access control
- • Authentication is handled by Supabase Auth (email + password)
- • Workspace data is scoped per workspace; our API doesn't return another workspace's data
- • SSO (SAML / OIDC) and enforced MFA are not yet available
Infrastructure
- • The app runs on Vercel; the database and sign-in run on Supabase
- • Background jobs (FCA register checks, alerts) run on Trigger.dev
- • Both Vercel and Supabase provide DDoS protection at the edge
Sub-processors
Firmwatcher is built on the following vendors. Their security certifications are theirs, not ours – listed here so you can include them in vendor due diligence.
| Vendor | Purpose | Vendor certifications |
|---|---|---|
| Supabase | Database and sign-in | SOC 2 Type II (per Supabase) |
| Vercel | Hosting and cookieless web analytics | SOC 2 Type II, ISO 27001 (per Vercel) |
| Trigger.dev | Background jobs: FCA register checks and alerts | See trigger.dev/security |
| Resend | Email delivery; demo request contacts | See the vendor’s security documentation |
| PostHog | Product analytics and error reports | See the vendor’s security documentation |
| Cal.com | Demo booking | See the vendor’s security documentation |
| Pushover | Internal notification of demo requests | See the vendor’s security documentation |
| Vercel AI Gateway | AI summaries of public FCA enforcement notices – no customer data | As Vercel |
| CookieChimp | Cookie notice | See the vendor’s security documentation |
Backups & continuity
Database backups are provided by Supabase under their managed plan. We do not currently offer a formal availability commitment (SLA).
For FCA-regulated firms
Firmwatcher may help support certain compliance workflows:
- Third-party monitoring: A check of the FCA Financial Services Register every morning for the firms and individuals on your watchlist
- Audit log: A record of acknowledgements and watchlist changes, exportable as CSV
We are not a substitute for your own internal controls. Need vendor due diligence information? Email team@firmwatcher.com.
Reporting security issues
Found a vulnerability? Please report it responsibly:
- Email details to team@firmwatcher.com
- Please don't publicly disclose it until we've had a chance to fix it
- We'll acknowledge your report and keep you informed of progress
We're grateful for responsible security researchers and won't take legal action against good-faith reports.
Your responsibility
- Use a strong, unique password
- Don't share login credentials
- Keep the email account you signed up with secure
- Tell us immediately if you suspect compromise
Questions?
For security or compliance questions, email team@firmwatcher.com.